FSDC 30th Meeting: Financial Sector Cyber Security Strategy

🗞️ Why in News Union Minister for Finance & Corporate Affairs Nirmala Sitharaman chaired the 30th meeting of the Financial Stability and Development Council (FSDC) in New Delhi on 23 October 2026. The Council reviewed the cyber resilience of the Indian financial sector and took note of the Financial Sector Cyber Security Strategy (FSCSS), formulated by an Inter-Ministerial Group of financial sector regulators and cybersecurity agencies.

For an aspirant, one item on this agenda stands out. For background: at its previous meeting, the 29th, held in Mumbai on 10 June 2025, the FSDC had considered strengthening the cyber resilience framework of the financial sector “through a financial sector-specific cybersecurity strategy”. At the 30th, it took note of the Financial Sector Cyber Security Strategy (FSCSS). The release does not set out what the strategy contains, so what can be studied now is the institution, the process and the cyber architecture the strategy sits in.

At a Glance: The 30th FSDC Meeting

The Cyber Security Strategy: What the Council Did

The release records the cyber items in one paragraph. The Council:

• reviewed the cyber resilience of the Indian financial sector and took note of the FSCSS, “formulated by an Inter-Ministerial Group (IMG) comprising of financial sector regulators and cybersecurity agencies, in coordination with the DEA, DFS and MeitY”;
• discussed India’s preparedness to protect Critical Information Infrastructure and the resilience of protection systems; and
• discussed improving the cybersecurity preparedness of Regional Rural Banks (RRBs).

Read the verbs closely. “Took note of” is the release’s phrase: it does not say the Council approved, adopted or released the strategy, and it does not describe the strategy’s contents. What the release offers is an expectation, not a result: “The implementation of the FSCSS is expected to strengthen the overall resilience of the Indian financial sector.”

The idea has a record in the Council’s own releases. At the 29th meeting, “In light of the analysis of cybersecurity regulations, sectoral preparedness, and the recommendations of Financial Sector Assessment Programme (FSAP) 2024-25”, the FSDC “considered strengthening the cyber resilience framework of the Indian financial sector through a financial sector-specific cybersecurity strategy.” Sixteen months later, the 30th meeting took note of the FSCSS.

India’s Cyber Security Architecture for Finance

The strategy enters a set-up that already has statutory and institutional parts. These are the parts an examiner can test.

• CERT-In (IT Act, 2000, section 70B). The Central Government appoints the Indian Computer Emergency Response Team by notification, and it “shall serve as the national agency for performing the following functions in the area of cyber security”. The functions include collecting, analysing and disseminating information on cyber incidents; forecasts and alerts; emergency measures for handling incidents; and coordinating incident response. Sections 70A and 70B were inserted by Act 10 of 2009, with effect from 27 October 2009.
• Critical Information Infrastructure (section 70). The Act defines it as “the computer resource, the incapacitation or destruction of which, shall have debilitating impact on national security, economy, public health or safety.” Under section 70A, the government may designate an organisation as the national nodal agency for Critical Information Infrastructure Protection.
• CSIRT-Fin. The Computer Security Incident Response Team-Finance Sector was set up on 15 May 2020 as a unit of CERT-In within the Ministry of Electronics and Information Technology (MeitY). CERT-In describes it as “a nodal sectoral CSIRT” that provides incident prevention and response services to entities of the Indian financial sector. A strategic advisory committee co-chaired by the Secretary (DEA) and the Secretary (MeitY) gives it strategic direction.
• DEA. A Cyber Security Section in the Department of Economic Affairs deals with formulating policies on cyber security and strengthening the cyber resilience of the financial sector.

The Director General of CERT-In, Dr. Sanjay Bahl, was among those who attended the 30th meeting. For a recent debate on CERT-In’s work, read our editorial analysis of 21 October.

The Rest of the Agenda

• Macro-financial stability: the Council deliberated on issues related to macro financial stability and India’s preparedness to deal with them.
• Fintech and tokenisation: it discussed promoting innovation in the fintech sector and exploring the prospects of tokenisation of financial assets and other real-world assets.
• Past decisions and Budget announcements: the FSDC discussed a strategy for implementing them, in four areas:
  • the domestic investment ecosystem and resource flow for investment, including in GIFT-IFSC;
  • simplifying and digitalising KYC processes, and digital onboarding for NRIs and FPIs;
  • reforms to scale up DPIs, including the Account Aggregator and the Unified Lending Interface (ULI) framework, with a focus on MSMEs;
  • reducing the cost of intermediation, making regulation more responsive, and rationalising Credit Guarantee Schemes.
• Risks: members stressed the need to be vigilant, especially in view of the ongoing geopolitical uncertainties, the AI boom and the steep rise in global bond yields. The release gives no figures for these.
• Decision: the members decided to strengthen inter-regulatory coordination for wider development of the financial sector.
• Unclaimed assets: the Finance Minister urged regulators and stakeholders to expedite refunds of unclaimed assets (bank deposits, dividends, shares, post office accounts, insurance and pension funds). The Council noted the success of the “Your Money, Your Right” campaign at the district level. A Department of Financial Services release of 31 December 2025 said the campaign, launched from Gandhinagar by the Finance Minister, held camps in 748 districts, and that unclaimed financial assets of approximately ₹4,200 crore had been restituted to their rightful owners.
• Meeting schedule: the Finance Minister urged the Council to hold FSDC meetings at more frequent intervals with a predefined schedule. This was an appeal; the release records no decision on it.
• Sub-Committee: the Council took note of the activities of the FSDC Sub-Committee, chaired by the RBI Governor, and of the action taken on pending past decisions.

Who Attended

The release lists these officials as having attended the meeting along with the Finance Minister.

Mains Lens: Why Finance Needs Its Own Cyber Strategy

• One sector, many regulators. The RBI, SEBI, IRDAI, PFRDA and IFSCA each regulate a part of the financial system, and all five heads sat at this meeting. A strategy formulated by an Inter-Ministerial Group of regulators and cybersecurity agencies is a coordinated answer to a risk that does not stop at one regulator’s boundary.
• Digital rails raise the stakes. The same meeting pushed digital KYC onboarding, the Account Aggregator and the Unified Lending Interface. The more finance runs on shared digital infrastructure, the more cyber resilience becomes a question of financial stability, which is the FSDC’s core remit.
• Coordination, not command. The Budget 2010-11 speech set up the Council “Without prejudice to the autonomy of regulators”. The Council was conceived as a coordinator that leaves each regulator’s autonomy intact, so a sector-wide strategy works only if each regulator acts on it.
• The weak links. The agenda singled out the cybersecurity preparedness of Regional Rural Banks. A connected sector is only as resilient as its least prepared entity.
• How often the Council meets. The 28th, 29th and 30th meetings were held on 21 February 2024, 10 June 2025 and 23 October 2026, more than 15 months apart each time. The Finance Minister’s call for a predefined schedule speaks to that gap.

Way forward (for answer writing): clear allocation of roles among the regulators, CERT-In and CSIRT-Fin; regular testing of incident response across the sector; capacity building in smaller entities such as RRBs; and a predefined FSDC calendar, as the Finance Minister urged.

What to Watch Next

• How the FSCSS is implemented by the regulators and agencies concerned.
• Whether the FSDC adopts a predefined meeting schedule, as the Finance Minister urged.

UPSC Relevance

GS Paper 3: Indian Economy and issues relating to planning, mobilization of resources, growth, development and employment; basics of cyber security.

GS Paper 2: Inter-agency coordination in government; regulatory bodies.

Prelims: the FSDC’s origin (notification of 30 December 2010), its chair (Union Finance Minister) and its Sub-Committee chair (RBI Governor); the FSCSS and who formulated it; CERT-In under section 70B of the IT Act, 2000; the definition of Critical Information Infrastructure; CSIRT-Fin (2020).

Mains: “Cyber resilience is now a question of financial stability. In the light of the Financial Sector Cyber Security Strategy taken note of by the FSDC, examine the role of inter-regulatory coordination in protecting India’s financial sector.” (GS3, 250 words)

📌 Facts Corner, Knowledgepedia

Prelims, statement-ready facts:

• 30th FSDC meeting: 23 October 2026, New Delhi, chaired by Union Finance Minister Nirmala Sitharaman
• FSDC: announced in Budget 2010-11; constituted by a Government of India notification dated 30 December 2010
• First FSDC meeting: 31 December 2010; the FSDC replaced the High Level Coordination Committee on Financial Markets (HLCCFM)
• FSDC chair: Union Finance Minister; FSDC Sub-Committee chair: Governor, RBI
• FSCSS: Financial Sector Cyber Security Strategy, formulated by an Inter-Ministerial Group of regulators and cybersecurity agencies
• The IMG worked in coordination with the DEA, DFS and MeitY
• 29th FSDC meeting: 10 June 2025, Mumbai; considered a financial sector-specific cybersecurity strategy
• CERT-In: the national agency for cyber security under section 70B of the IT Act, 2000
• CSIRT-Fin: set up on 15 May 2020 as a unit of CERT-In within MeitY

Prelims, the traps:

• The Council “took note of” the FSCSS; the release does not say it approved, adopted or released the strategy
• The FSDC is chaired by the Finance Minister, but its Sub-Committee is chaired by the RBI Governor
• The 29th meeting was held in Mumbai (10 June 2025); the 30th was in New Delhi (23 October 2026)
• Critical Information Infrastructure is defined in section 70 of the IT Act; CERT-In is set up under section 70B

Mains, arguments and keywords:

• A sector-wide cyber strategy needs many regulators to act together; the FSDC exists for inter-regulatory coordination
• Digital KYC, the Account Aggregator and ULI widen the digital base of finance, making cyber resilience a stability issue
• Keywords: cyber resilience, inter-regulatory coordination, Critical Information Infrastructure, macro-prudential supervision, tokenisation

Interview, be ready for:

• “Why should a council chaired by the Finance Minister discuss cyber security?” Because a cyber incident in finance is a stability risk that crosses regulators.

Sources: PIB, Ministry of Finance, “FSDC stresses heightened vigilance and proactive measures to mitigate emerging risks to India’s financial stability”, 23 October 2026. PIB, Ministry of Finance, releases on the 29th FSDC meeting (June 2025) and the 28th FSDC meeting (February 2024). PIB, Ministry of Finance, on the constitution of the FSDC (3 May 2013). Union Budget 2010-11, Budget speech, para 37. Department of Economic Affairs, Annual Report 2025-26, and the page of its Financial Stability and Cyber Security Division. Indian Economic Service, Arthapedia: Financial Stability and Development Council. Information Technology Act, 2000 (India Code), sections 70, 70A and 70B. CERT-In, CSIRT-Fin. PIB, Department of Financial Services, on the “Your Money, Your Right” campaign, December 2025.

Cite this page: FSDC 30th Meeting: Financial Sector Cyber Security Strategy — Ujiyari.com | Free UPSC & State PCS Current Affairs